Bitcoin CMP
Add (add) instruction
Add DST, Src / / byte / word
operation: DST = DST + SRC
1, That is, DST and Src must have a general-purpose register operand.
2. Segment registers cannot be used as SRC and DST.
3. The influence flag bits are auxiliary crray flag, carry flag, overflow flag, parity flag, sign flag and zero flag, as follows:
CF is set according to whether the most significant bit has an in (out) bit: if there is an in (out) bit, CF = 1, When there is no leading (borrowing) bit, CF = 0.
of is set according to the sign and change of the operands: if the sign of two operands is the same, and the sign of the result is opposite, of = 1, otherwise it is 0.
ZF is set according to the result: ZF = 0 when it is not equal to 0, ZF = 1 when it is equal to 0
SF is set according to the highest bit of the result: the highest bit is 0, Then SF = 0.
AF is set according to whether D3 enters (borrows) to D4 when adding: AF = 1 when there is an entering (borrowing) position, AF = 0 when there is no entering (borrowing) position
PF is set according to whether the number of 1 in the result is odd or not: pf = 0 when the number of 1 is odd, When the number is even, PF = 1
the owner leaves the mailbox
I'll send the CHM to you
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
suppose that one of the two numbers is in ax and the other is in BX
CMP ax, BX; CMP instruction and sub instruction affect the same flag bits (sub affects the same flag bits as add), but the result will not be saved
JZ E; After executing CMP ax and BX, ZF flag bit 1, JZ is the conditional jump instruction, and when ZF is 1, it jumps
the full name of AES is advanced encryption standard, namely advanced encryption standard. The project was started by the National Institute of standards and Technology (NIST) in 1997 and collected algorithms. Rijndael was adopted as its final algorithm in 2000. It was approved as the new federal information encryption standard (FIPS pub 197) by the Secretary of Commerce in 2001
FIPS pub 197 indicates that the official effective date of the standard is May 26, 2002. The standard will be reassessed by NIST every five years
the designers of Rijndael algorithm adopted by AES are Joan Daemen (proton world int.l) and Vincent Rijmen (katholieke Universiteit Leuven, esat-cosic). The names of the algorithms come from the combination of letters in their names. Rijndael is a symmetric block encryption algorithm, with variable packet length and key length, which can be specified as 128 bits, 192 bits and 256 bits respectively. However, the data packet length in AES only uses 128 bits in Rijndael instead of 192 and 256 bits. The key length is the same as that of Rijndael, which is 128 bits, 192 bits and 256 bits respectively, and is called AES-128, aes-192 and AES-256 respectively
unlike traditional block ciphers, AES does not use Feistel structure (such as that used in DES), but uses three different reversible consistent transformation layers: linear mixing layer, nonlinear layer and key addition layer. For the specific mathematical basis and process of the algorithm, please refer to: http://csrc.nist.gov/publications/fips/fips197/fips- 197. PDF
recognition and tracking skills of AES algorithm and analysis of crackme examples, For example, the S-box starts with:
...
the reverse S-box used in the decryption process starts with:
....
we use the hexadecimal editor to open the target file search, or search in memory. If we find it, we can basically determine that the target is AES algorithm
2 basic skills of AES algorithm analysis
it is very troublesome to track how to encrypt or decrypt. There is a way to be lazy. Generally, AES algorithm implemented in C language will initialize the key before formally encrypting the data. If the call is found by you, it will be OK, because the call will pass the key string. Finding the key means that we can calculate it by our own program
3 example analysis
this example is the crackme program of AES algorithm written by lordor [nuke group] (it has been included in the CD, and the file is crackme.rar)
first of all, you can use peid to detect crackme.exe to see if it has been shelled. Fortunately, lordor is very kind and has not been shelled. In addition, peid has a plug-in Kanal, which can check whether there are known encryption methods in the file. We can clearly see that the crackme does use Rijndael in Kanal
we use softice's symbol loader to load and run crackme.exe
click Help - & gt; Register, you can see that the program has given a code:718368679 Note: different machines are different. We call it machine code
then we enter a serial number in the serial box at will, use softice next breakpoint BPX getdlgitemtexta,
and click Check, we will find the following code:
: 00401248 mov ESI, [ESP + 000004a4]
: 0040124f push 32
: 00401251 push 0040e374
: 00401256 push 000003e9
: 0040125b push ESI
: 0040125c call [user32! GetDlgItemTextA] ; After this call, we can see the random serial number just entered in 40e374< br />:00401262 PUSH 00
:00401264 PUSH 00
:00401266 PUSH 000003E8
:0040126B PUSH ESI
:0040126C CALL [USER32! GetDlgItemInt] ; After this call, eax returns 0x2ad16fa7, that is, decimal machine code 718368679
: 00401272 push 10
: 00401274 push 0040e340
: 00401279 push eax
: 0040127a mov [ESP + 14], eax
: 0040127e call 004076e6; The machine code 0x2ad16fa7 is converted into a string form, that is, place: & quot; 2ad16fa7"< br />:00401283 ADD ESP,0C
:00401286 PUSH 0040E304
:0040128B PUSH 0040E374
:00401290 LEA ECX,[ESP+24]
:00401294 CALL 004023B0 ; We just entered the random serial number with AES encryption, put 40e304 place< br />:00401299 PUSH 0040E304
:0040129E PUSH 0040E374
:004012A3 CALL 00401000 ; Just random input sequence number into hexadecimal form, and stored in 40e304 place!! If it is less than 16 bytes, it will be mixed with the original content; If it is just 16 bytes, it will cover the original content< br />
:004012A8 XOR EAX,EAX
:004012AA MOV ECX,0000000C
:004012AF MOV EDI,0040E374
:004012B4 REPZ STOSD ; Clear the contents at 40e374
: 004012b6 add ESP, 08
: 004012b9 push 0040e374
: 004012be push 0040e304
: 004012c3 lea ECX, [ESP + 24]
: 004012c7 stosw
: 004012c9 call 004026b0; Decrypt the data at 40e304 with AES to get the internal registration code, and store it at 40e374
: 004012ce mov eax, 0040e374
: 004012d3 lea EDX, [eax + 01]
: 004012d6 mov Cl, [eax]
: 004012d8 Inc eax
: 004012d9 test Cl, CL
: 004012db JNZ 004012d6
: 004012dd mov Cl, [0040e374]
: 004012e3 sub eax, EDX
: 004012e5 CMP Cl, 30; Compare whether the first character at 40e374 is & 39; 0', If not, error
: 004012e8 JNZ 004013b1
: 004012ee CMP byte PTR [eax + 0040e373], 3D; Compare whether the last character is & 39= 39;, If not, error
: 004012f5 JNZ 004013b1
: 004012fb CMP eax, 10; Compare whether the length of the decrypted string is 16, if not, error
: 004012fe JNZ 004013b1
: 00401304 mov EDX, [0040e379]
: 0040130a XOR eax, eax
: 0040130c mov ECX, 0000000c
: 00401311 mov EDI, 0040e304
: 00401316 repz stosd; Empty 40e304 content
: 00401318 mov ECX, [0040e375]
: 0040131e stosw
: 00401320 mov eax, [0040e37d]
: 00401325 mov [0040e308], EDX
: 0040132b mov DL, [0040e340]
: 00401331 mov [0040e30c], eax
: 00401336 CMP DL, [0040e308]< br />:0040133C MOV [0040E304],ECX
:00401342 MOV CX,[0040E381] ; If you look at the memory with softice, you can see that the code here is
: 00401349 mov [0040e310], CX; 14 of the decrypted strings are intercepted and placed at 40e304.
: 00401350 JNZ 004013b1; Compare the first bit of machine code with the sixth bit of 16 bit registration code,
; If not, error
: 00401352 push 00
: 00401354 push 00408208
: 00401359 push 004081c
: 0040135e push 00
: 00401360 call [user32! MessageBoxA] ; If equal, welcome message will be displayed< br />:00401366 MOV AL,[0040E343]
:0040136B CMP AL,[0040E309] ; Then compare the 4th bit of machine code with the 7th bit of 16 bit registration code
: 00401371 JNZ 0040138a; If not, error
: 0040137mov ECX, [0040e33c]
: 00401379 push 00000085
: 0040137e push ECX
: 0040137f call [user32! LoadBitmapA] ; If it is equal, the picture will be displayed< br />:00401385 MOV [0040E338],EAX
:0040138A PUSH ESI
:0040138B CALL [USER32! Getmenu]
: 00401391 push 01
notice that the picture still can't be displayed at this time, there are dark piles
so we use bpmd 40e308 r in some undetermined parts of the 16 bit registration code:
after many attempts, we find that in:
: 004015ef mov DL, [0040e344]
: 004015f5 CMP DL, [0040e30a]; Compare the 5th bit of machine code with the 8th bit of 16 bit registration code
: 004015fb JNZ 00401663; If not, error
: 004015fd push ebx
: 004015fe call [user32! GetDC] ; If it is equal, DC
: 00401604 mov ESI, eax
: 00401606 push ESI
: 00401607 call [gdi32! Create compatible DC]
only in this way can the image be displayed! What a nice woman<
AES algorithm summary
the following breakpoints are used in the analysis process:
00) BPX user32! GetDlgItemTextA
01) BPX 00401350 DO " r eip 401352"< br />02) BPX 00401371 DO " r eip 401373"< br />03) BPX 004012E8 DO " r eip 401304"< br />04) BPMD 40E308 R
05) BPX 004015FB DO " r eip 4015fd"
the registration process is actually such a process:
1) get the original string (serial number) input by the user and encrypt it with AES
2) convert the original string to hexadecimal representation, and 1) store the result overlapped (if the number of digits is correct, it will be covered)
3) decrypt the result of 2) with AES to get the internal registration code
the internal registration code must meet the following requirements:
1) 16 bytes in length
2) 39 at the beginning; 0', It ends with 39= 39;
3) the 6th bit must be equal to the 1st bit of the machine code
4) the 7th bit must be equal to the 4th bit of the machine code
5) the 8th bit must be equal to the 5th bit of the machine code
6) there are no restrictions on other bits
we know that the algorithm of AES is symmetric, we can construct an internal registration code and get an original available serial number through AES encryption
when the machine code is 718368679, it is converted to 2ad16fa7 in hexadecimal, that is & quot; 2ad16fa7" We construct a:
0 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216 ^ ^ 216, Input directly in the registration dialog box:
0123416abcdefa =
then set the breakpoint to 00401294. The memory 40e304 is the original serial number in hexadecimal, which is translated into a string:
AES algorithm is mainly used for data encryption, and the key must be kept secret. However, in order to introce AES algorithm, this crackme writes the key directly in the program, Otherwise, simple data decryption will not be feasible< br />:00401230 PUSH EDI
:00401231 PUSH 10
:00401233 PUSH 10
:00401235 PUSH 00408210
:0040123A LEA EAX,[ESP+18]
:0040123E PUSH EAX ; Note here
: 0040123f lea ECX, [ESP + 2C]
: 00401243 call 00401840; Initializing AES
in addition, lordor intentionally left a back door for everyone to learn (I didn't understand it until he told me.)< In the last issue, we saw the introction of Des. By comparison, we can find that DES and AES belong to plaintext block encryption, and encryption and decryption are symmetrical. However, AES, as a substitute for DES, solves the problem that DES keys are too short to break. At present, AES keys longer than 256 bits can be used to encrypt data, which can ensure strong security. At present, DES algorithm is widely used in software registration algorithm in the market. Maybe because AES has just come out, AES has not been widely used as part of the registration algorithm (after all, des has a history of more than 20 years). However, we can see that the advantage of AES long key will be enough to encrypt data, such as combining with RSA, DSA and other public key algorithms to encrypt key keys, Play a very strong security. I hope you can have a deep understanding of the principle and application of block cipher through the introction of these two encryption algorithms.
varreverse_pairs = 0//逆序数
defmsort[T](cmp:(T, T) => Boolean)(l:List[T]):List[T] = {
defmerge(l1:List[T], l2:List[T]):List[T]=(l1, l2)match{
case(Nil, _) => l2
case(_, Nil) => l1
case(x::left1, y::left2) =>
if(cmp(x, y))
x::merge(left1, l2)
else{
reverse_pairs += l1.length
y::merge(l1, left2)
}
}
valn = l.length / 2
if(n == 0)
return l
else{
val(l1, l2) = l.splitAt(n)
merge(msort(cmp)(l1), msort(cmp)(l2))
}
}
println(msort((x:Int, y:Int) => x<y)(List(5, 4, 3, 2, 7,6 )))
println(reverse_pairs)
}
the original working mode of CPU
before understanding the working principle of CPU, let's talk about how CPU is proced. The CPU is made of very pure silicon. A CPU chip contains millions of smart transistors. Transistors are chemically etched or photolithographed on a silicon chip the size of a fingernail. Therefore, in this sense, CPU is composed of transistors. In short, transistors are micro electronic switches. They are the cornerstone of building CPU. You can think of a transistor as an electric light switch. They have an operation bit, representing two states: on and off. This on and off is equivalent to the transistor on and off, and these two states just correspond to the basic binary state "0" and "1"! In this way, the computer has the ability to process information. But don't think that the principle of transistors with simple "0" and "1" states is very simple. In fact, their development has been achieved through years of hard research by scientists. Before transistors, computers relied on slow, inefficient vacuum tubes and mechanical switches to process information. Later, researchers put two transistors in a silicon crystal, creating the first integrated circuit, and then the microprocessor. Seeing this, you must want to know how transistors use the "0" and "1" electronic signals to execute instructions and process data? In fact, all electronic devices have their own circuits and switches. The flow or disconnection of electrons in the circuit is completely controlled by the switch. If you set the switch to off, the electrons will stop flowing. If you set it to on again, the electrons will continue to flow. The switch between on and off of transistor is only controlled by electronic signal. We can call transistor binary device. In this way, the on state of the transistor is represented by "1", while the off state is represented by "0", which can form the simplest binary number. The special order and pattern of "1" and "0" proced by many transistors can represent different situations, which are defined as letters, numbers, colors and graphics. For example, 1 in decimal is also "1" in binary mode, 2 is "10" in binary mode, 3 is "11", 4 is "100", 5 is "101", 6 is "110", and so on. This constitutes the binary language and data used in computer work. Groups of transistors can be combined to store numerical values, as well as perform logical and numerical operations. With the control of quartz clock, transistor groups perform their functions synchronously like a complex machine<
the internal structure of CPU
now we have a general idea of what the CPU is responsible for, but which components are responsible for processing data and executing programs
1. Alu (arithmetic logic unit)
Alu is the core of arithmetic unit. It is a circuit based on full adder, supplemented by shift register and corresponding control logic. Under the action of control signal, it can complete four arithmetic operations of addition, subtraction, multiplication and division and various logic operations. As mentioned just now, this is equivalent to the proction line in the factory, which is responsible for calculating data
2. Register group RS (register set or registers)
RS is actually the place where data is temporarily stored in CPU, in which data waiting to be processed or processed are stored. The CPU needs less time to access registers than memory. The use of registers can rece the number of CPU access to memory, thus improving the CPU speed. However, e to the limitation of chip area and integration, the capacity of register group can not be very large. Register group can be divided into special register and general register. The function of special register is fixed, which stores the corresponding data separately. General purpose registers are widely used and can be specified by programmers. The number of general purpose registers varies from microprocessor to microprocessor
3. Control unit
just like the Logistics Distribution Department of a factory, control unit is the command and control center of the whole CPU, which is composed of instruction register (IR), instruction decoder (ID) and operation controller (0C). It is very important to coordinate the orderly work of the whole computer. According to the user's pre programmed program, it takes out each instruction from the memory in turn, puts it in the instruction register IR, determines what operation should be carried out through instruction decoding (analysis), and then sends the micro operation control signal to the corresponding components according to the determined timing through the operation controller OC. The operation controller OC mainly includes beat pulse generator, control matrix, clock pulse generator, reset circuit, start stop circuit and other control logic
4. Bus (bus)
is like the communication channel between different parts of a factory. Bus is actually a group of wires, a collection of various common signal wires, which is used as a "highway" for all components of the computer to transmit information. The bus directly connected with CPU can be called local bus. It includes data bus dB, address bus AB and control bus CB. The data bus is used to transmit data information; The address bus is used to transmit the address information sent by CPU; Control bus is used to transmit control signal, timing signal and status information<
CPU work flow
the CPU composed of transistors is the core of processing data and executing programs. Its English full name is: central processing unit, or central processing unit. Firstly, the internal structure of CPU can be divided into control unit, logic operation unit and storage unit (including internal bus and buffer). The working principle of CPU is like a factory's processing of procts: the raw materials (program instructions) entering the factory are sent to the proction line (logic operation unit) through the scheling and distribution of the material Distribution Department (control unit), and the finished procts (processed data) are proced and then stored in the warehouse (storage unit), and finally waiting to be sold on the market (for the application program to use). In this process, we notice that the CPU starts the formal work from the control unit, and the intermediate process is to carry out the operation processing through the logic operation unit, and then to the storage unit to represent the end of the work
operation of data and instructions in CPU
just now, we have introced the components and basic principles of CPU. Now, let's see how data runs in CPU. We know that data flows through the memory from the input device, waiting for CPU processing. The information to be processed is stored by byte, that is, 8-bit binary number or 8-bit as a unit. The information can be data or instructions. Data can be binary characters, numbers or colors, etc. Instructions tell the CPU what to do with the data, such as adding, subtracting, or shifting. We assume that the data in memory is the simplest raw data. First, the instruction pointer will inform the CPU to place the instruction to be executed in the memory. Because each memory unit in memory has a number (called address), the data can be taken out according to these addresses and sent to the control unit through the address bus. The instruction decoder takes the instruction from the instruction register IR and translates it into the form that can be executed by the CPU, and then decides what necessary operations are needed to complete the instruction. It will tell the arithmetic logic unit (ALU) when to calculate, Tell the instruction reader when to get the value, tell the instruction decoder when to translate the instruction, and so on. If the data is sent to the ALU, the data will perform the arithmetic operations and other operations specified in the instruction. When the data is processed, it will return to the register and continue to run through different instructions or send it to the data buffer through DB bus. Basically, the CPU is to read data, process data and write data to memory. But in general, an instruction can contain many operations executed in a clear order. The CPU's job is to execute these instructions. After completing an instruction, the CPU's control unit will tell the instruction reader to read the next instruction from the memory to execute. This process repeats itself quickly, executing one instruction after another quickly, procing the results you see on the monitor. It is easy for us to think that while processing so many instructions and data, e to the time difference of data transfer and CPU processing, chaotic processing will certainly occur. In order to ensure that every operation happens on time, the CPU needs a clock, which controls every action executed by the CPU. Clock is like a metronome, it keeps sending out pulses to determine the CPU's pace and processing time, which is known as the nominal speed of CPU, also known as the main frequency. The higher the dominant frequency is, the faster the CPU works<
the main frequency, external frequency and frequency multiplication
the main frequency is also called the clock frequency, and its unit is MHz, which is used to indicate the CPU's operation speed. The working frequency (main frequency) of CPU includes two parts: external frequency and double frequency, the proct of which is the main frequency. The full name of frequency doubling is frequency doubling coefficient. There is a ratio relationship between the main frequency and external frequency of CPU. This ratio is the frequency doubling coefficient, which is called frequency doubling for short. Frequency doubling can be from 1.5 to 23 or higher, with 0.5 as an interval unit. The multiplication of external frequency and frequency multiplication is the main frequency, so any improvement can make the main frequency of CPU rise. Because the main frequency does not directly represent the operation speed, so in some cases, the actual operation speed of CPU with higher main frequency is lower. Therefore, the dominant frequency is only one aspect of CPU performance, and does not represent the overall performance of CPU
million calculations that can be run at processor cycles per second. In general, processors with higher MHz or GHz can improve the performance of computers running innovative, entertainment, communications and proctivity applications. But the main frequency only affects the overall performance of the system. The overall performance of the machine with high main frequency is not necessarily high
we know that computers have many accessories, and different accessories lead to different speeds. In 286, 386 and early 486 computers, the speed of CPU is not too high, and the speed of memory remains the same. Later, with the rapid increase of CPU speed, e to the electrical structure of the memory, it was unable to improve the speed as high as the CPU (even if the memory now reached 400 or 533, but compared with the speed of several g of CPU, it was not a level at all). As a result, there was a speed difference between the memory and the CPU. At this time, a concept of CPU dominant frequency, frequency doubling and external frequency was proposed, External frequency, as the name suggests, is the frequency outside the CPU, that is, the frequency of the memory. The CPU uses this frequency to connect with the memory. The main frequency of CPU is the actual operation speed inside the CPU, and the main frequency must be
When it comes to where the world's largest trading market is, you may not be familiar with it, but if it is the dark net trading market, you may know something about it. This trading platform can only be accessed through a specific browser, and gold coins are not paper currencies such as U.S. dollars and euro, but bitcoin and Monroe digital currencies, which can also effectively help buyers and sellers to cover up their own information. Why cover up your own information? Naturally, these transactions are illegal and dark< in the dark network, people can be traded, drugs can be traded, and assassinations can be carried out & hellip& hellip; All in all, it's just that you can't think of it and they can't buy it
but I want to make a digression. Although engaged in the manipulation of the dark net, Janet himself is an anarchist, and he is very tolerant of all extreme liberal ideas. He supports both drug trading and customer privacy exchange& mdash; The bottom line is that child pornography and terrorism are not allowed. This may be the only human nature in his life! Compared with what Janet has done, some people may be ashamed of themselves
